Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.
Findings corrected:
- R-1 (major): the UDP front door's in-band decode created a fresh
DatagramReader per call and kept only the first frame of a batch —
POC #2's first-cut bug (reader state must persist across calls;
batched datagrams were silently dropped, mid-frame EOF was silent).
Fix: an owning InbandBridge (persistent reader + pending queue +
fail-loud mid-frame EOF, the AssociateSession shape) threaded
through the channel->socket pump; pinned by three bridge unit
tests (which fail against the per-call reader) and an end-to-end
doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
DoorBuildError (both door builders' .build() is now Result),
ProducerDoorBuildError/ProducerDoorError (the bind decision is
serve's typed error), the composed table invariant as an egress
error, register_forwarded_serving -> Result (the alkcall
diagnostic surfaced), TokenClientError (wrap on a spent client).
New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
described a channel pipe — the landed ProducerDoor serves
serve_socks5_over on the accepted socket directly;
associate_with_token's doc (the TCP door refuses ASSOCIATE, never
calls it); SessionOwner's doc (the accept uses SyncHalves/
OwnedWrite).
Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.
Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).
- ADR-014 accepted (review 002 C-2): the pre-command handshake, the
BIND quiet wait, and the association lifetime are all
teardown-governed; the protocol layer never times out (option 1)
- the BIND relationship recorded as same regime (ADR-007 decided one
phase's ends by designing BIND; ADR-014 records the inherited
resolution — one principle, not two)
- the doors' accept-path obligations recorded pre-batch-2 (accept-stage
idle bound, per-credential/per-peer caps, accept-queue bounds);
revisitable additively (an optional producer-side idle seam would
be config, not wire)
- spec lines carry the decided posture: wire.md (association-lifetime
bullet, no-in-band-control bullet, preamble, frontmatter);
producer.md (the open handler, the local-backend section, decision
table, frontmatter); overview.md ADR index
- one upstream-fidelity correction: upstream's dial timeout maps to
0x06 (TTL expired), not 0x01 as the review sketch suggested
- open-questions.md unchanged (C-2 was never tracked there)
Verification: cargo test green (357 passed), clippy -D warnings clean,
fmt clean, cargo doc clean, wasm check + clippy (wasm32) clean
The batch-1 gate review (tasks/implementation/review-protocol-core.md):
all eight criteria examined (seam contracts, wire fidelity, access
control, teardown/lifecycle, conventions, wasm, POC fidelity, docs
sync); the gate to batch 2 opens. Findings R-1/R-2 were corrected in
the review change; R-3..R-5 are doc residues fixed in the same change;
R-6 is accepted with rationale.
- R-1 (major): the datagram stage's Ok(None) re-park is unsafe against
a zero-yield egress — a next_reply that is a pure instantly-ready
Ok(None) with no await wins every select! poll and livelocks the
stage on a current-thread runtime (empirically reproduced; the
landed unit test's mutex masked the hazard at its lock's yield
boundary; multi-thread survives). Fix: the Ok(None) handler yields
before re-parking; a pinning unit test drives the strictest
zero-yield violator.
- R-2: the two into_inner expect()s (consumer sessions) become typed
Result<_, SpentSessionError> — convention 2's no-panic rule; spent-
session unit tests pin the shape; test call sites updated.
- R-3/R-4/R-5: doc residues — stale task-time phrasings in
egress.rs/producer.rs, producer.md's register() sketch reconciled
to the landed signature, the establishment-bound test doc reworded
to what the substrate-free probe actually pins.
- R-6 (accepted): the wasm gate rides a transitive getrandom/wasm_js
feature unification (alkcall -> jsonschema/referencing -> ahash) —
verified compiling clean today; noted for OQ-SK2-06.
Verified: cargo test 348 green; --all-features green; clippy
--all-targets -D warnings clean; fmt --check clean; both wasm checks
clean (from a clean wasm target dir); cargo doc --no-deps clean.
The bind-only-identity reconciliation from the integration session
was independently verified as correct (ADR-006 as landed; the suite
pins it). Batch boundary holds: no local/composed code exists.
glm-5.3-flash